I want to locate and remove the search engine
http://search.xrenoder.com/ which has attached itself to the home page
of Windows Explorer 5.5 so that it always comes up when i try to do a
search in the MSN.com search engine

andre8291..

Xrenoder is what is called a hijack, a type of spyware.  Spyware are
aplications that track what you view on the web or send advertisements
based upon your web surfing habits.  A hijack modifies certain
settings within your computer to redirect you to other sites when you
try to go to another.  You can get more information about hijacks and
spyware at http://www.spywareinfo.com/articles/hijacked/

Now, regarding xrenoder.  From the research I did, this is a fairly
new hijack that has appeared to be immune to the various applications
that remove these types of programs, such as ad-aware
(http://www.lavasoftusa.com/).  However, have no fear, there is a fix.
 On your hard drive, there is a file called hosts.  It will be located
in the C:\Windows directory of your hard drive.  The hosts file can be
used to help speed access to the sites listed in it.  There may be two
files named hosts in this directory.  One will be listed as Hosts.sam,
the other will be hosts (no extension).  You have two options.  You
can either delete the hosts file altogether or you can open the hosts
file in a text editor, such as Notepad, and remove all the lines that
mention "xrenoder" then save the file.  This should fix your problem.

I would recommend you download ad-aware from LavaSoft
(http://www.lavasoftusa.com/).  This product will scan your system for
spyware and help you rid your system of these applications.

Thanks for your question and if you need any further clarification,
please let me know.

Regards,

-THV

Search Strategy:
xrenoder removal
xrenoder spyware

References:
Newsgroup Posting
http://groups.google.com/groups?q=xrenoder+remove&hl=en&lr=&ie=UTF-8&selm=uzkDYmFjCHA.2380%40tkmsftngp09&rnum=5

Webmaster World Message Forum
http://www.webmasterworld.com/forum10/1464.htm

Spyware Info Message Forum
http://www.spywareinfo.com/yabbse/index.php?board=11;action=display;threadid=1911
Host Files
http://www.smartin-designs.com/

Spyware Info
http://www.spywareinfo.com/

---

Request for Answer Clarification by andre8291-ga on 20 Nov 2002 04:57 PST

Your solution worked right away! I need to clarifiy a couple of
points, however.
(1) I deleted both host files, hosts and hosts.sam. Have I wiped out
anything else that I might have wanted to keep? (2)  How do these host
files get created?
Will they reappear at the next hijacking?

---

Clarification of Answer by tar_heel_v-ga on 20 Nov 2002 05:32 PST

Deleting the hosts file will have no effect on the performance of
anything else.  The hosts file creation is part of Windows and has
nothing to do with any spyware or hijacks.  They simply (like most
scumware) take advantage of certain aspects of the operating system. 
It may appear again if you receive another hijack, however, by using
ad-aware from LavaSoft, it checks your hosts file.  It just happens
that xrenoder is very new and they haven't created a profile for it. 
I am sure it will be in the next update.

Regards,

-THV

It seems great but the proof of the pudding ................. I
haven't tried to see if it works. If it does, I'll get back. Meanwhile
thanks for a prompt answer